prevent local file access (see security advisory GHSA-mwc7-64wg-pgvj)

zauberzeug · Apr 12, 2024 · ed12eb1 · ed12eb1
1 parent 7c3e01a
commit ed12eb1
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/nicegui/nicegui.py b/nicegui/nicegui.py
@@ -96,6 +96,10 @@ def _get_component(key: str) -> FileResponse:
 def _get_resource(key: str, path: str) -> FileResponse:
     if key in resources:
         filepath = resources[key].path / path
+        try:
+            filepath.resolve().relative_to(resources[key].path.resolve())  # NOTE: use is_relative_to() in Python 3.9
+        except ValueError as e:
+            raise HTTPException(status_code=403, detail='forbidden') from e
         if filepath.exists():
             headers = {'Cache-Control': 'public, max-age=3600'}
             media_type, _ = mimetypes.guess_type(filepath)